Breaking Lab srl
A critical flaw in Zoom's annotation feature could have allowed any meeting participant to silently take over another attendee's computer. No clicks, no downloads, and no visible warnings were required.
Three independent research efforts have demonstrated ways to defeat passkey protections without breaking their underlying cryptography. The findings cast doubt on the widely held belief that passkeys are a near-perfect defence against phishing.
New research reveals CSS-based attack techniques that allow content inside an email to escape its message boundary and compromise the webmail interface itself. Gmail, Outlook, Proton Mail, and others are affected.
MIT CSAIL researchers have discovered a novel CPU-level attack called INTERRUPT INJECTION that defeats existing Spectre v2 mitigations on Intel and AMD processors. The technique exploits a timing gap between branch-predictor sanitization and kernel execution.
Jeff Dean, one of the most influential figures in modern AI, is departing Google alongside other senior researchers to found a startup focused on accelerating scientific discovery with artificial intelligence. The move marks a landmark moment for the industry.
Unit 42 researchers have detailed three attack paths that allow ordinary user-level malware on Windows to silently sign into passkey-protected accounts via Google Password Manager. The findings raise serious questions about passkeys as a silver-bullet authentication solution.
Researchers at Unit 42 have uncovered three attack paths that allow malware on a compromised Windows machine to silently abuse Google Password Manager's synced passkeys. The findings cast serious doubt on passkeys as an unbreakable authentication solution.
A 2021 firmware error in the Coldcard hardware wallet routed seed generation to a flawed pseudorandom number generator, exposing thousands of wallets. Attackers exploited the vulnerability to drain over 1,000 Bitcoin addresses in under an hour.
A new research paper argues that large language models cannot be made fully secure against prompt injection and related attacks due to a fundamental architectural flaw. The findings carry major implications for every product built on top of AI models.
A coordinated cyberattack struck more than 30 Minnesota community water systems over two days in late July, forcing one plant offline and triggering a statewide emergency response. The incident highlights the growing vulnerability of critical public infrastructure to digital threats.
Anthropic's Claude Mythos Preview has cracked a post-quantum signature scheme and found a dramatically faster attack on seven-round AES-128. The findings raise serious questions about AI's role in offensive cryptanalysis.
A privacy issue with Anthropic's Claude allowed shared conversation links to be crawled and indexed by Google, potentially exposing sensitive user data. The incident raises fresh questions about how AI platforms handle user-generated shareable content.
